var v
MSG "Clear ALL Breakpoints, make sure Olly is set to pass ALL exceptions to the program"
gpa "WriteProcessMemory","kernel32.dll"
mov v,$RESULT
MSG "Press on the Play button when it appears. Please not that if this app is Expired, you must first perfom the Javascript patch"
bp v
eob FIRSTHIT:
run

FIRSTHIT:
//Writes the .pecode section
eob SECONDHIT
run

SECONDHIT:
//Writes the .pccode section (first time)
eob LASTHIT:
run

LASTHIT:
//Re-Writes .pccode section to prevent manipulation.
bc v
var pccode
mov pccode,esp
add pccode,8
mov pccode,[pccode]
bprm pccode,2000
eob FINDJUMP
run

FINDJUMP:
// Finds the jump that determines trial session playability
bpmc
find eip,#751A68????????8B4DA881C1B0000000E8????????32C0E9????????E9????????#
var theJump
mov theJump, $RESULT
cmt theJump, "The Magic Jump"
bp theJump
eob PATCHJUMP

PATCHJUMP:
// Patch the jump to make in an unconditional jump
bc theJump
var JmpAddress
var PatchLoc
mov JmpAddress, eip
add JmpAddress,1C
eval "jmp {JmpAddress}"
mov PatchLoc, eip
asm PatchLoc, $RESULT
gpa "CreateProcessA", "kernel32.dll"
mov v, $RESULT
bp v
eob DUMPHERE
run

DUMPHERE:
bc v
rtu
find eip, #898544FFFFFF8B55088B4204#
var cmtline
mov cmtline, $RESULT
add cmtline, 0D
bp cmtline
eob COMMENT
run

COMMENT:
cmt eip,"Dump Shell Process to File using LordPE"
ret